0

I was running performance_schema query to check for users performing DDL on our databases, and found a NULL user, which however does not exists when i check the mysql database for users using the query below:

select user, host from user;

The query that is showing the NULL user accounts when using performance_schema is:

SELECT user, host, SUBSTR(event_name, 15) AS event_name, count_star
  FROM performance_schema.events_statements_summary_by_account_by_event_name
 WHERE count_star > 0 AND
     ( event_name LIKE 'statement/sql/create%'
    OR event_name LIKE 'statement/sql/alter%'
    OR event_name LIKE 'statement/sql/drop%'
    OR event_name LIKE 'statement/sql/rename%'
    OR event_name LIKE 'statement/sql/grant%'
    OR event_name LIKE 'statement/sql/revoke%'
    OR event_name LIKE 'statement/sql/optimize%'
    OR event_name LIKE 'statement/sql/truncate%'
    OR event_name LIKE 'statement/sql/repair%'
    OR event_name LIKE 'statement/sql/check%'
     );

Results:

+--------------+---------------+------------------+------------+
| user         | host          | event_name       | count_star |
+--------------+---------------+------------------+------------+
| NULL         | NULL          | create_table     |         50 |
| NULL         | NULL          | alter_table      |         79 |
| NULL         | NULL          | truncate         |         10 |
| NULL         | NULL          | drop_table       |         25 |
| NULL         | NULL          | grant            |          6 |
| NULL         | NULL          | create_db        |          2 |
| NULL         | NULL          | rename_table     |          6 |
| NULL         | NULL          | create_user      |          6 |
| NULL         | NULL          | drop_user        |          6 |
| NULL         | NULL          | create_trigger   |         18 |
| NULL         | NULL          | drop_trigger     |         18 |
| root         | localhost     | create_table     |        919 |
| root         | localhost     | alter_table      |       1918 |
| root         | localhost     | truncate         |         13 |
| root         | localhost     | drop_table       |        850 |
| root         | localhost     | grant            |          3 |

So what is this NULL user account?

3
  • Tip: AND event_name REGEXP '^statement/sql/(create|alter|drop|rename|grant|revoke|optimize|truncate|repair|check)';
    – Rick James
    Nov 2 '18 at 17:15
  • I can't explain the NULL, but turning on the "general log" and looking at it might give you some more clues. I'll be interested to hear what you find.
    – Rick James
    Nov 2 '18 at 17:16
  • I too have some NULL user in SELECT * FROM performance_schema.accounts so if you have new clues about its signification, please share : ) Doc says "This is NULL for an internal thread, or for a user session that failed to authenticate." but then, what would be the "internal thread"?
    – Xenos
    Aug 8 '19 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.